17.1. Linux Tripwire 2.2.1

According to the official [Tripwire site]: Tripwire works at the most fundamental layer, protecting the servers and workstations that make up the corporate network. Tripwire works by first scanning a computer and creating a database of system files, a compact digital snapshot of the system in a known secure state. The user can configure Tripwire very precisely, specifying individual files and directories on each machine to monitor, or creating a standard template that can be used on all machines in an enterprisewide environement. Once this baseline database is created, a system administrator can use Tripwire to check the integrity of a system at any time. By scanning the current system and comparing that information with the data stored in the database, Tripwire detects and reports any additions, deletions, or changes to the system outside of the specified boundaries. If these changes are valid, the administrator can update the baseline database with the new information. If malicious changes are found, the system administrator will instantly know exactly which part, which component etc. of the network have been affected.

This version of Tripwire has significant product enhancements over previous versions of Tripwire. Some of the enhancements include:

• Multiple levels of reporting allow you to choose different levels of report detail.

• Syslog option sends information about database initialization, database update, policy update and integrity check to the syslog.

• Database performance has been optimized to increase the efficiency of integrity checks.

• Individual email recipients can be sent certain sections of a report.

• SMTP email reporting support.

• Email test mode enables you to verify that the email settings are correct.

• Ability to create multiple sections within a policy file to be executed separately.

These installation instructions assume:

• Commands are Unix-compatible.

• The source path is /var/tmp -other paths are possible.

• Installations were tested on Red Hat Linux 6.1 and 6.2.

• All steps in the installation will happen in super-user account root.

• Tripwire version number is 2.2.1

These are the Package(s) you need to install:

Tripwire Homepage: http://www.tripwiresecurity.com/

You must be sure to download: Tripwire_221_for_Linux_x86_tar.gz

To Compile Tripwire-2.2.1, you do need to Decompress the tarball tar.gz.:

[root@deep] /#cp Tripwire_version_for_Linux_x86_tar.gz /var/tmp [root@deep] /#cd /var/tmp [root@deep ]/tmp# tar xzpf Tripwire_version_for_Linux_x86_tar.gz